Yes, the token will expire after roughly 60 days and they’ll have to go through the process again, although if you remove force_verify=true from the url, the user will only be asked to grant your app permissions the first time they go through it, from then on they will instantly be sent back to your redirect url with a token (unless they have disconnected your app from their Twitch account).
The validation endpoint should return the expires_in value https://dev.twitch.tv/docs/authentication#validating-requests